@alexkroman1/aai-cli 5.8.1 → 5.9.0

package/README.md

@@ -52,8 +52,12 @@ required credentials, and print the agent's public URL.
   outside one it runs `init`.
 - `--server <url>` targets a self-hosted platform; the origin is remembered
   in your user config after explicit approval.
+- `aai login` is the only way to authenticate — it links an account already
+  signed in to the studio. An exported `ASSEMBLYAI_API_KEY` does not log you
+  in; in a project that variable is a provider credential for `aai dev`.
 - The API key is stored `0600` in your user config dir (`AAI_CONFIG_DIR`
-  overrides the location).
+  overrides the location). Non-interactive callers point `AAI_CONFIG_DIR` at a
+  config dir holding a key from an interactive `aai login`.
 
 ## Documentation
 

package/dist/{_agent-2nVugrN3.mjs → _agent-BPEXSdWX.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as readProjectConfig, i as readGlobalConfig, n as ensureApiKey, o as serverOrigin, t as approveServer } from "./_config-Y5V-5Krn.mjs";
+import { a as readProjectConfig, i as readGlobalConfig, n as ensureApiKey, o as serverOrigin, t as approveServer } from "./_config-BJm2o795.mjs";
 import { existsSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/{_config-Y5V-5Krn.mjs → _config-BJm2o795.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as log, o as CliError } from "./_ui-8kOEB-JH.mjs";
+import { t as CliError } from "./_output-CC300DzW.mjs";
 import { a as errorMessage, c as readJson, d as writeJson } from "./_utils-Ch0J4s6a.mjs";
 import { mkdtempSync } from "node:fs";
 import path from "node:path";
@@ -131,43 +131,30 @@ async function writeGlobalConfig(configDir, data) {
 	await writeJson(path.join(configDir, "config.json"), data, { mode: 384 });
 }
 /**
-* Persist the API key to the global config, warning (not failing) when the
-* config dir is unwritable — the key in hand still works for this run.
-*/
-async function trySaveApiKey(dir, config, apiKey) {
-	try {
-		await writeGlobalConfig(dir, {
-			...config,
-			apiKey
-		});
-	} catch (err) {
-		log.warn(`Couldn't save your API key to ${path.join(dir, "config.json")}: ${errorMessage(err)} — you'll be prompted again next run.`);
-	}
-}
-/**
 * The credential every platform command runs on.
 *
-* Two sources, in order: the key `aai login` saved, then
-* `ASSEMBLYAI_API_KEY` for non-interactive callers (CI, scripts, the eval
-* harnesses).
+* ONE source: the key `aai login` saved to the global config. Nothing else
+* authenticates the CLI.
+*
+* There is deliberately no "paste a key" prompt and no `ASSEMBLYAI_API_KEY`
+* fallback. Both produced the same half-configured CLI — able to push,
+* publish, and read/write another account's secrets while linked to no
+* account the user could see in the studio — and both made `aai login`, the
+* real onboarding path, optional in practice. The env var was the worse of
+* the two: it applies to every invocation in a shell, it silently PERSISTED
+* itself into the global config on first use (so the CLI stayed authenticated
+* as that key long after the export was gone), and it collides with the
+* variable the same name serves in a project `.env`, where it is a *provider*
+* credential for the local dev server rather than a platform identity.
 *
-* There is deliberately NO "paste a key" prompt. Pasting one produced a
-* half-configured CLI — able to push and publish while linked to no account
-* the user could see in the studio — and it made `aai login`, which is the
-* real onboarding path, optional in practice. It was also the riskier code
-* path: a hidden password prompt reads stdin, so a piped invocation could
-* have its input eaten and persisted as the API key.
+* Non-interactive callers (CI, scripts, the eval harnesses) authenticate by
+* pointing `AAI_CONFIG_DIR` at a config dir holding a key from an interactive
+* `aai login`.
 */
 async function ensureApiKey(configDir) {
-	const dir = configDir ?? getConfigDir();
-	const config = await readGlobalConfig(dir);
+	const config = await readGlobalConfig(configDir ?? getConfigDir());
 	if (config.apiKey) return config.apiKey;
-	const envKey = process.env.ASSEMBLYAI_API_KEY;
-	if (envKey) {
-		await trySaveApiKey(dir, config, envKey);
-		return envKey;
-	}
-	throw new CliError("not_logged_in", "You're not logged in.", "Run `aai login` to link your account, or set ASSEMBLYAI_API_KEY for non-interactive use.");
+	throw new CliError("not_logged_in", "You're not logged in.", "Run `aai login` to link your account. Non-interactive setups can point AAI_CONFIG_DIR at a config dir holding a logged-in key.");
 }
 //#endregion
 export { readProjectConfig as a, writeGlobalConfig as c, readGlobalConfig as i, writeProjectConfig as l, ensureApiKey as n, serverOrigin as o, getConfigDir as r, updateProjectConfig as s, approveServer as t };

package/dist/_config.d.ts

@@ -64,16 +64,23 @@ export declare function writeGlobalConfig(configDir: string, data: GlobalConfig)
 /**
  * The credential every platform command runs on.
  *
- * Two sources, in order: the key `aai login` saved, then
- * `ASSEMBLYAI_API_KEY` for non-interactive callers (CI, scripts, the eval
- * harnesses).
+ * ONE source: the key `aai login` saved to the global config. Nothing else
+ * authenticates the CLI.
  *
- * There is deliberately NO "paste a key" prompt. Pasting one produced a
- * half-configured CLI — able to push and publish while linked to no account
- * the user could see in the studio — and it made `aai login`, which is the
- * real onboarding path, optional in practice. It was also the riskier code
- * path: a hidden password prompt reads stdin, so a piped invocation could
- * have its input eaten and persisted as the API key.
+ * There is deliberately no "paste a key" prompt and no `ASSEMBLYAI_API_KEY`
+ * fallback. Both produced the same half-configured CLI — able to push,
+ * publish, and read/write another account's secrets while linked to no
+ * account the user could see in the studio — and both made `aai login`, the
+ * real onboarding path, optional in practice. The env var was the worse of
+ * the two: it applies to every invocation in a shell, it silently PERSISTED
+ * itself into the global config on first use (so the CLI stayed authenticated
+ * as that key long after the export was gone), and it collides with the
+ * variable the same name serves in a project `.env`, where it is a *provider*
+ * credential for the local dev server rather than a platform identity.
+ *
+ * Non-interactive callers (CI, scripts, the eval harnesses) authenticate by
+ * pointing `AAI_CONFIG_DIR` at a config dir holding a key from an interactive
+ * `aai login`.
  */
 export declare function ensureApiKey(configDir?: string): Promise<string>;
 export {};

package/dist/{_dev-server-BB5N8kdh.mjs → _dev-server-Cnf4jNzE.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { n as log } from "./_ui-8kOEB-JH.mjs";
+import { n as log } from "./_ui-RZmPgrF6.mjs";
 import { a as errorMessage, r as errorCode } from "./_utils-Ch0J4s6a.mjs";
 import { n as fallbackHtmlPlugin } from "./client-bundler-yiWoXrgb.mjs";
 import { buildWorker } from "./worker-bundler.mjs";
 import { n as createWorkerEvaluator } from "./_bundler-Cjaxa2wi.mjs";
-import { n as ensureApiKey } from "./_config-Y5V-5Krn.mjs";
+import { n as ensureApiKey } from "./_config-BJm2o795.mjs";
 import { t as resolveServerEnv } from "./_server-common-CnaP_Urf.mjs";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
@@ -51,7 +51,9 @@ function agentEnvWarnings(agentDef, env, shellEnv = process.env) {
 }
 async function resolveAgentEnv(root, agentDef) {
 	const env = await resolveServerEnv(root);
-	if (requiredProviderEnvVars(agentDef).includes("ASSEMBLYAI_API_KEY") && !env.ASSEMBLYAI_API_KEY) env.ASSEMBLYAI_API_KEY = await ensureApiKey();
+	const required = requiredProviderEnvVars(agentDef);
+	const hasShellKey = Boolean(process.env.ASSEMBLYAI_API_KEY);
+	if (required.includes("ASSEMBLYAI_API_KEY") && !env.ASSEMBLYAI_API_KEY && !hasShellKey) env.ASSEMBLYAI_API_KEY = await ensureApiKey();
 	for (const warning of agentEnvWarnings(agentDef, env)) log.warn(warning);
 	return env;
 }

package/dist/{_init-Dei2JRmn.mjs → _init-DVNeyGSl.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { c as readJson, d as writeJson, s as isEexist } from "./_utils-Ch0J4s6a.mjs";
-import { r as isDevMode, t as getMonorepoRoot } from "./_agent-2nVugrN3.mjs";
-import { REPO_URL, downloadAndMergeTemplate } from "./_templates-BfyRyE7z.mjs";
+import { r as isDevMode, t as getMonorepoRoot } from "./_agent-BPEXSdWX.mjs";
+import { REPO_URL, downloadAndMergeTemplate } from "./_templates-DDx08LIG.mjs";
 import path from "node:path";
 import fs from "node:fs/promises";
 //#region _init.ts

package/dist/{_ui-8kOEB-JH.mjs → _output-CC300DzW.mjs}

@@ -1,6 +1,4 @@
 #!/usr/bin/env node
-import { styleText } from "node:util";
-import * as p from "@clack/prompts";
 //#region _output.ts
 /**
 * Determine output mode from CLI flags and TTY state.
@@ -72,43 +70,4 @@ var CliError = class extends Error {
 	}
 };
 //#endregion
-//#region _ui.ts
-const noop = () => {};
-let silenced = false;
-/** Log instance that delegates to clack (human mode) or no-ops (JSON mode). */
-const log = new Proxy(p.log, { get(target, prop, receiver) {
-	return silenced ? noop : Reflect.get(target, prop, receiver);
-} });
-/** Replace all log methods with no-ops. Call once in JSON mode. */
-function silenceOutput() {
-	silenced = true;
-}
-/**
-* Unwrap a clack prompt result, exiting cleanly if the user cancelled.
-* `message` lets the caller name what was cancelled (e.g. "Setup cancelled").
-*/
-function unwrapCancel(result, message = "Cancelled") {
-	if (p.isCancel(result)) {
-		p.cancel(message);
-		process.exit(0);
-	}
-	return result;
-}
-/** Format a URL for display. */
-function fmtUrl(url) {
-	return styleText("cyanBright", url);
-}
-/**
-* Parse and validate a port string. Returns the numeric port or throws.
-*
-* Deliberately zod-free: this module loads on every CLI invocation
-* (including `aai --help`), and keeping zod off that path is the same
-* startup-cost invariant `_utils.ts` documents for its error helpers.
-*/
-function parsePort(raw) {
-	const port = raw.trim() === "" ? NaN : Number(raw);
-	if (!Number.isInteger(port) || port < 0 || port > 65535) throw new Error(`Invalid port: ${raw}. Must be a number between 0 and 65535.`);
-	return port;
-}
-//#endregion
-export { unwrapCancel as a, getOutputMode as c, writeLine as d, silenceOutput as i, installStdoutGuard as l, log as n, CliError as o, parsePort as r, fail as s, fmtUrl as t, ok as u };
+export { ok as a, installStdoutGuard as i, fail as n, writeLine as o, getOutputMode as r, CliError as t };

package/dist/{_slug-api-CGJSST9B.mjs → _slug-api-CQw1YGR5.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as getServerInfo } from "./_agent-2nVugrN3.mjs";
+import { n as getServerInfo } from "./_agent-BPEXSdWX.mjs";
 import { n as apiRequest, t as HINT_NOT_DEPLOYED } from "./_api-client-B-upMGkc.mjs";
 //#region _slug-api.ts
 /**

package/dist/{_templates-BfyRyE7z.mjs → _templates-DDx08LIG.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { a as errorMessage } from "./_utils-Ch0J4s6a.mjs";
-import { t as getMonorepoRoot } from "./_agent-2nVugrN3.mjs";
+import { t as getMonorepoRoot } from "./_agent-BPEXSdWX.mjs";
 import { existsSync } from "node:fs";
 import path from "node:path";
 import fs from "node:fs/promises";

package/dist/{_typecheck-gate-DvE8S3aQ.mjs → _typecheck-gate-BT4iPz7A.mjs}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { n as log, o as CliError } from "./_ui-8kOEB-JH.mjs";
+import { t as CliError } from "./_output-CC300DzW.mjs";
+import { n as log } from "./_ui-RZmPgrF6.mjs";
 import { typecheckProject } from "./typecheck.mjs";
 //#region _typecheck-gate.ts
 /**

package/dist/_ui-RZmPgrF6.mjs

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+import { styleText } from "node:util";
+import * as p from "@clack/prompts";
+//#region _ui.ts
+const noop = () => {};
+let silenced = false;
+/** Log instance that delegates to clack (human mode) or no-ops (JSON mode). */
+const log = new Proxy(p.log, { get(target, prop, receiver) {
+	return silenced ? noop : Reflect.get(target, prop, receiver);
+} });
+/** Replace all log methods with no-ops. Call once in JSON mode. */
+function silenceOutput() {
+	silenced = true;
+}
+/**
+* Unwrap a clack prompt result, exiting cleanly if the user cancelled.
+* `message` lets the caller name what was cancelled (e.g. "Setup cancelled").
+*/
+function unwrapCancel(result, message = "Cancelled") {
+	if (p.isCancel(result)) {
+		p.cancel(message);
+		process.exit(0);
+	}
+	return result;
+}
+/** Format a URL for display. */
+function fmtUrl(url) {
+	return styleText("cyanBright", url);
+}
+/**
+* Parse and validate a port string. Returns the numeric port or throws.
+*
+* Deliberately zod-free: this module loads on every CLI invocation
+* (including `aai --help`), and keeping zod off that path is the same
+* startup-cost invariant `_utils.ts` documents for its error helpers.
+*/
+function parsePort(raw) {
+	const port = raw.trim() === "" ? NaN : Number(raw);
+	if (!Number.isInteger(port) || port < 0 || port > 65535) throw new Error(`Invalid port: ${raw}. Must be a number between 0 and 65535.`);
+	return port;
+}
+//#endregion
+export { unwrapCancel as a, silenceOutput as i, log as n, parsePort as r, fmtUrl as t };

package/dist/{build-BXwDB78d.mjs → build-WdGtFsSx.mjs}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
-import { n as log, o as CliError, u as ok } from "./_ui-8kOEB-JH.mjs";
+import { a as ok, t as CliError } from "./_output-CC300DzW.mjs";
+import { n as log } from "./_ui-RZmPgrF6.mjs";
 import { r as evalWorkerBundle, t as buildAgentBundle } from "./_bundler-Cjaxa2wi.mjs";
-import { assertTypechecks } from "./_typecheck-gate-DvE8S3aQ.mjs";
-import { classifyVitestError, runVitest } from "./test-3Gq4pqH_.mjs";
+import { assertTypechecks } from "./_typecheck-gate-BT4iPz7A.mjs";
+import { classifyVitestError, runVitest } from "./test-CkXvfcpq.mjs";
 //#region build.ts
 /**
 * `aai build` — bundle the agent without deploying, behind the same gates

package/dist/cli.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { c as getOutputMode, d as writeLine, i as silenceOutput, l as installStdoutGuard, n as log, o as CliError, s as fail } from "./_ui-8kOEB-JH.mjs";
+import { i as installStdoutGuard, n as fail, o as writeLine, r as getOutputMode, t as CliError } from "./_output-CC300DzW.mjs";
+import { i as silenceOutput, n as log } from "./_ui-RZmPgrF6.mjs";
 import { a as errorMessage, l as resolveCwd, o as fileExists, t as AGENT_ENTRY } from "./_utils-Ch0J4s6a.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
@@ -165,7 +166,7 @@ const list = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = resolveCwd();
-			const { executeList } = await import("./studio-_UBBvh5V.mjs");
+			const { executeList } = await import("./studio-B6zDNPPr.mjs");
 			return executeList({
 				cwd,
 				server: args.server
@@ -200,7 +201,7 @@ const pull = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = resolveCwd();
-			const { executePull } = await import("./studio-_UBBvh5V.mjs");
+			const { executePull } = await import("./studio-B6zDNPPr.mjs");
 			return executePull({
 				cwd,
 				project: args.project,
@@ -228,7 +229,7 @@ const push = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup({ agent: true });
-			const { executePush } = await import("./studio-_UBBvh5V.mjs");
+			const { executePush } = await import("./studio-B6zDNPPr.mjs");
 			return executePush({
 				cwd,
 				server: args.server,
@@ -258,7 +259,7 @@ const publish = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup({ agent: true });
-			const { executePublish } = await import("./studio-_UBBvh5V.mjs");
+			const { executePublish } = await import("./studio-B6zDNPPr.mjs");
 			return executePublish({
 				cwd,
 				server: args.server,
@@ -316,7 +317,7 @@ const init = defineCommand({
 	},
 	async run({ args }) {
 		await runCommand(args, async (mode) => {
-			const { executeInit } = await import("./init-BpBbttOv.mjs");
+			const { executeInit } = await import("./init-BYGp3Usr.mjs");
 			return executeInit({
 				dir: args.dir,
 				force: args.force,
@@ -345,7 +346,7 @@ const dev = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup({ agent: true });
-			const { executeDev } = await import("./dev-C4KyxouE.mjs");
+			const { executeDev } = await import("./dev-HBCgChsA.mjs");
 			return executeDev({
 				cwd,
 				port: args.port
@@ -362,7 +363,7 @@ const test = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup();
-			const { executeTest } = await import("./test-3Gq4pqH_.mjs");
+			const { executeTest } = await import("./test-CkXvfcpq.mjs");
 			return executeTest(cwd);
 		});
 	}
@@ -386,7 +387,7 @@ const build = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup({ agent: true });
-			const { executeBuild } = await import("./build-BXwDB78d.mjs");
+			const { executeBuild } = await import("./build-WdGtFsSx.mjs");
 			return executeBuild({
 				cwd,
 				skipTests: args.skipTests,
@@ -420,7 +421,7 @@ const deploy = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup({ agent: true });
-			const { executeDeploy } = await import("./deploy-Cp-wgME3.mjs");
+			const { executeDeploy } = await import("./deploy-Bij1jES6.mjs");
 			return executeDeploy({
 				cwd,
 				server: args.server,
@@ -443,7 +444,7 @@ const del = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup();
-			const { executeDelete } = await import("./delete-DRNfvczK.mjs");
+			const { executeDelete } = await import("./delete-Dr1Jn65f.mjs");
 			return executeDelete({
 				cwd,
 				server: args.server
@@ -474,7 +475,7 @@ const secret = defineCommand({
 			async run({ args }) {
 				await runCommand(args, async (mode) => {
 					const cwd = await setup();
-					const { executeSecretPut, NO_INPUT, readStdin } = await import("./secret-Dr0qnxeb.mjs");
+					const { executeSecretPut, NO_INPUT, readStdin } = await import("./secret-vhGe-r2a.mjs");
 					const value = mode === "json" ? await readStdin() : void 0;
 					if (mode === "json" && !value) throw new CliError(...NO_INPUT);
 					return executeSecretPut(cwd, args.name, value, args.server);
@@ -498,7 +499,7 @@ const secret = defineCommand({
 			async run({ args }) {
 				await runCommand(args, async () => {
 					const cwd = await setup();
-					const { executeSecretDelete } = await import("./secret-Dr0qnxeb.mjs");
+					const { executeSecretDelete } = await import("./secret-vhGe-r2a.mjs");
 					return executeSecretDelete(cwd, args.name, args.server);
 				});
 			}
@@ -515,7 +516,7 @@ const secret = defineCommand({
 			async run({ args }) {
 				await runCommand(args, async () => {
 					const cwd = await setup();
-					const { executeSecretList } = await import("./secret-Dr0qnxeb.mjs");
+					const { executeSecretList } = await import("./secret-vhGe-r2a.mjs");
 					return executeSecretList(cwd, args.server);
 				});
 			}
@@ -550,7 +551,7 @@ const storage = defineCommand({
 			},
 			async run({ args }) {
 				await runCommand(args, async () => {
-					const { executeStorageStatus } = await import("./storage-CoQB8d-u.mjs");
+					const { executeStorageStatus } = await import("./storage-CMPsAmch.mjs");
 					return executeStorageStatus(resolveStorageCwd(args.dir), args.server);
 				});
 			}
@@ -567,7 +568,7 @@ const storage = defineCommand({
 			},
 			async run({ args }) {
 				await runCommand(args, async () => {
-					const { executeStorageEnable } = await import("./storage-CoQB8d-u.mjs");
+					const { executeStorageEnable } = await import("./storage-CMPsAmch.mjs");
 					return executeStorageEnable(resolveStorageCwd(args.dir), args.server);
 				});
 			}
@@ -589,7 +590,7 @@ const storage = defineCommand({
 			},
 			async run({ args }) {
 				await runCommand(args, async () => {
-					const { executeStorageDisable } = await import("./storage-CoQB8d-u.mjs");
+					const { executeStorageDisable } = await import("./storage-CMPsAmch.mjs");
 					return executeStorageDisable(resolveStorageCwd(args.dir), {
 						server: args.server,
 						force: args.force
@@ -610,7 +611,7 @@ const login = defineCommand({
 	},
 	async run({ args }) {
 		await runCommand(args, async () => {
-			const { executeLogin } = await import("./login-AA_UdRI-.mjs");
+			const { executeLogin } = await import("./login-CXazkkcR.mjs");
 			return executeLogin({ server: args.server });
 		});
 	}
@@ -623,7 +624,7 @@ const templates = defineCommand({
 	args: { json: sharedArgs.json },
 	async run({ args }) {
 		await runCommand(args, async (mode) => {
-			const { listTemplates } = await import("./_templates-BfyRyE7z.mjs");
+			const { listTemplates } = await import("./_templates-DDx08LIG.mjs");
 			const names = await listTemplates();
 			if (mode === "human") {
 				for (const name of names) log.message(name);

package/dist/{delete-DRNfvczK.mjs → delete-Dr1Jn65f.mjs}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
-import { n as log, u as ok } from "./_ui-8kOEB-JH.mjs";
-import { l as writeProjectConfig } from "./_config-Y5V-5Krn.mjs";
-import { i as resolveDeployTarget, n as getServerInfo } from "./_agent-2nVugrN3.mjs";
+import { a as ok } from "./_output-CC300DzW.mjs";
+import { n as log } from "./_ui-RZmPgrF6.mjs";
+import { l as writeProjectConfig } from "./_config-BJm2o795.mjs";
+import { i as resolveDeployTarget, n as getServerInfo } from "./_agent-BPEXSdWX.mjs";
 import { n as apiRequest, t as HINT_NOT_DEPLOYED } from "./_api-client-B-upMGkc.mjs";
 //#region delete.ts
 async function runDelete(opts) {

package/dist/{deploy-Cp-wgME3.mjs → deploy-Bij1jES6.mjs}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
-import { n as log, t as fmtUrl, u as ok } from "./_ui-8kOEB-JH.mjs";
+import { a as ok } from "./_output-CC300DzW.mjs";
+import { n as log, t as fmtUrl } from "./_ui-RZmPgrF6.mjs";
 import { a as errorMessage } from "./_utils-Ch0J4s6a.mjs";
 import { t as buildAgentBundle } from "./_bundler-Cjaxa2wi.mjs";
-import { s as updateProjectConfig } from "./_config-Y5V-5Krn.mjs";
+import { s as updateProjectConfig } from "./_config-BJm2o795.mjs";
 import { t as resolveServerEnv } from "./_server-common-CnaP_Urf.mjs";
-import { i as resolveDeployTarget } from "./_agent-2nVugrN3.mjs";
-import { assertTypechecks } from "./_typecheck-gate-DvE8S3aQ.mjs";
+import { i as resolveDeployTarget } from "./_agent-BPEXSdWX.mjs";
+import { assertTypechecks } from "./_typecheck-gate-BT4iPz7A.mjs";
 import { n as apiRequest } from "./_api-client-B-upMGkc.mjs";
 import { gzipSync } from "node:zlib";
 //#region _deploy.ts

package/dist/{dev-C4KyxouE.mjs → dev-HBCgChsA.mjs}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { n as log, r as parsePort, t as fmtUrl, u as ok } from "./_ui-8kOEB-JH.mjs";
+import { a as ok } from "./_output-CC300DzW.mjs";
+import { n as log, r as parsePort, t as fmtUrl } from "./_ui-RZmPgrF6.mjs";
 import { i as errorDetail } from "./_utils-Ch0J4s6a.mjs";
 import path from "node:path";
 import { styleText } from "node:util";
@@ -11,7 +12,7 @@ import { styleText } from "node:util";
 async function executeDev(opts) {
 	const port = parsePort(opts.port);
 	const agentName = path.basename(path.resolve(opts.cwd));
-	const { startDevServer } = await import("./_dev-server-BB5N8kdh.mjs");
+	const { startDevServer } = await import("./_dev-server-Cnf4jNzE.mjs");
 	let cleanup;
 	let shuttingDown = false;
 	const onSignal = () => {

package/dist/{init-BpBbttOv.mjs → init-BYGp3Usr.mjs}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
-import { a as unwrapCancel, n as log, u as ok } from "./_ui-8kOEB-JH.mjs";
+import { a as ok } from "./_output-CC300DzW.mjs";
+import { a as unwrapCancel, n as log } from "./_ui-RZmPgrF6.mjs";
 import { a as errorMessage, c as readJson, l as resolveCwd, o as fileExists, t as AGENT_ENTRY } from "./_utils-Ch0J4s6a.mjs";
-import { r as isDevMode, t as getMonorepoRoot } from "./_agent-2nVugrN3.mjs";
+import { r as isDevMode, t as getMonorepoRoot } from "./_agent-BPEXSdWX.mjs";
 import path from "node:path";
 import { styleText } from "node:util";
 import * as p from "@clack/prompts";
@@ -74,7 +75,7 @@ function resolveTargetDir(dir) {
 }
 /** Publish after init and return deploy metadata if successful. */
 async function tryPublish(cwd, server) {
-	const { executePublish } = await import("./studio-_UBBvh5V.mjs");
+	const { executePublish } = await import("./studio-B6zDNPPr.mjs");
 	try {
 		const result = await executePublish({
 			cwd,
@@ -93,7 +94,7 @@ async function tryPublish(cwd, server) {
 }
 /** Scaffold the project, optionally showing a spinner. */
 async function scaffoldProject(dir, cwd, template, silent) {
-	const { runInit } = await import("./_init-Dei2JRmn.mjs");
+	const { runInit } = await import("./_init-DVNeyGSl.mjs");
 	const s = silent ? void 0 : p.spinner();
 	s?.start(`Creating ${dir}`);
 	await runInit({

package/dist/{login-AA_UdRI-.mjs → login-CXazkkcR.mjs}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
-import { n as log, o as CliError, u as ok } from "./_ui-8kOEB-JH.mjs";
-import { c as writeGlobalConfig, i as readGlobalConfig, r as getConfigDir, t as approveServer } from "./_config-Y5V-5Krn.mjs";
-import { a as resolveServerUrl } from "./_agent-2nVugrN3.mjs";
+import { a as ok, t as CliError } from "./_output-CC300DzW.mjs";
+import { n as log } from "./_ui-RZmPgrF6.mjs";
+import { c as writeGlobalConfig, i as readGlobalConfig, r as getConfigDir, t as approveServer } from "./_config-BJm2o795.mjs";
+import { a as resolveServerUrl } from "./_agent-BPEXSdWX.mjs";
 import { spawn } from "node:child_process";
 import { setTimeout } from "node:timers/promises";
 import { randomBytes } from "node:crypto";
@@ -103,7 +104,7 @@ async function pollForGrant(fetchFn, serverUrl, code, opts) {
 	}
 }
 function requireTty() {
-	if (!process.stdin.isTTY) throw new CliError("login_interactive", "`aai login` is interactive and needs a TTY.", "Non-interactive setups can set the ASSEMBLYAI_API_KEY environment variable instead.");
+	if (!process.stdin.isTTY) throw new CliError("login_interactive", "`aai login` is interactive and needs a TTY.", "Log in on a machine with a terminal, then point AAI_CONFIG_DIR at that config dir — logging in is the only way to authenticate.");
 }
 function openerFor(platform) {
 	if (platform === "darwin") return ["open", []];
@@ -144,7 +145,7 @@ async function executeLogin(opts, deps = {}) {
 	const globalConfig = await readGlobalConfig();
 	const serverUrl = resolveServerUrl(opts.server, void 0, globalConfig.approvedServers ?? []);
 	if (opts.server) await approveServer(serverUrl);
-	if ((await jsonBody(await reachable(fetchFn, `${serverUrl}/studio/auth`, serverUrl), "Reading the server's login configuration")).mode === "none") throw new CliError("login_unavailable", "This server has no browser login configured, so there is no account to link.", "Set the ASSEMBLYAI_API_KEY environment variable instead — it's the only other way to authenticate.");
+	if ((await jsonBody(await reachable(fetchFn, `${serverUrl}/studio/auth`, serverUrl), "Reading the server's login configuration")).mode === "none") throw new CliError("login_unavailable", "This server has no browser login configured, so there is no account to link.", "Point `--server` at a platform with browser login configured — linking an account there is the only way to authenticate.");
 	const code = randomBytes(32).toString("base64url");
 	const linkUrl = `${serverUrl}/?cli-link=${code}`;
 	log.info(`Opening the browser to link your account…\n  ${linkUrl}`);

package/dist/scaffold/CLAUDE.md

@@ -929,8 +929,10 @@ Never hardcode secrets in agent code.
   `ctx.env`.
 - **Production:** `npx @alexkroman1/aai-cli secret put NAME`
 - **Access:** `ctx.env.MY_KEY` in tool execute functions.
-- **AssemblyAI key:** CLI prompts on first use, stores globally. No `.env`
-  entry needed. For CI, set `ASSEMBLYAI_API_KEY` env var.
+- **AssemblyAI key:** `npx @alexkroman1/aai-cli login` links your account and
+  stores the key globally — the only way the CLI authenticates. No `.env`
+  entry needed. For CI, point `AAI_CONFIG_DIR` at a config dir holding a
+  logged-in key (an exported `ASSEMBLYAI_API_KEY` does not authenticate).
 
 ## Voice rules for systemPrompt
 

package/dist/scaffold/package.json

@@ -11,15 +11,15 @@
     "publish:agent": "aai publish"
   },
   "dependencies": {
-    "@alexkroman1/aai": "^5.8.1",
-    "@alexkroman1/aai-ui": "^5.8.1",
+    "@alexkroman1/aai": "^5.9.0",
+    "@alexkroman1/aai-ui": "^5.9.0",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "tailwindcss": "^4.0.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@alexkroman1/aai-cli": "^5.8.1",
+    "@alexkroman1/aai-cli": "^5.9.0",
     "@tailwindcss/vite": "^4.3.3",
     "@types/node": "^26.1.1",
     "@types/react": "^19.2.17",

package/dist/{secret-Dr0qnxeb.mjs → secret-vhGe-r2a.mjs}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
-import { a as unwrapCancel, n as log, s as fail, u as ok } from "./_ui-8kOEB-JH.mjs";
-import { t as slugRequest } from "./_slug-api-CGJSST9B.mjs";
+import { a as ok, n as fail } from "./_output-CC300DzW.mjs";
+import { a as unwrapCancel, n as log } from "./_ui-RZmPgrF6.mjs";
+import { t as slugRequest } from "./_slug-api-CQw1YGR5.mjs";
 import * as p from "@clack/prompts";
 import { text } from "node:stream/consumers";
 //#region secret.ts

package/dist/{storage-CoQB8d-u.mjs → storage-CMPsAmch.mjs}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
-import { n as log, s as fail, u as ok } from "./_ui-8kOEB-JH.mjs";
-import { t as slugRequest } from "./_slug-api-CGJSST9B.mjs";
+import { a as ok, n as fail } from "./_output-CC300DzW.mjs";
+import { n as log } from "./_ui-RZmPgrF6.mjs";
+import { t as slugRequest } from "./_slug-api-CQw1YGR5.mjs";
 import * as p from "@clack/prompts";
 //#region storage.ts
 async function storageRequest(cwd, init, server) {

package/dist/{studio-_UBBvh5V.mjs → studio-B6zDNPPr.mjs}

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
-import { n as log, o as CliError, t as fmtUrl, u as ok } from "./_ui-8kOEB-JH.mjs";
-import { s as updateProjectConfig } from "./_config-Y5V-5Krn.mjs";
+import { a as ok, t as CliError } from "./_output-CC300DzW.mjs";
+import { n as log, t as fmtUrl } from "./_ui-RZmPgrF6.mjs";
+import { s as updateProjectConfig } from "./_config-BJm2o795.mjs";
 import { t as resolveServerEnv } from "./_server-common-CnaP_Urf.mjs";
-import { i as resolveDeployTarget } from "./_agent-2nVugrN3.mjs";
-import { layerScaffold } from "./_templates-BfyRyE7z.mjs";
+import { i as resolveDeployTarget } from "./_agent-BPEXSdWX.mjs";
+import { layerScaffold } from "./_templates-DDx08LIG.mjs";
 import { n as apiRequest } from "./_api-client-B-upMGkc.mjs";
 import path from "node:path";
 import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
@@ -290,7 +291,7 @@ async function syncEnvSecrets(cwd, serverUrl, apiKey, slug) {
 }
 async function executePublish(opts) {
 	if (!opts.skipTypecheck) {
-		const { assertTypechecks } = await import("./_typecheck-gate-DvE8S3aQ.mjs");
+		const { assertTypechecks } = await import("./_typecheck-gate-BT4iPz7A.mjs");
 		await assertTypechecks(opts.cwd);
 	}
 	const pushed = await pushProject(opts);

package/dist/{test-3Gq4pqH_.mjs → test-CkXvfcpq.mjs}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { n as log, s as fail, u as ok } from "./_ui-8kOEB-JH.mjs";
+import { a as ok, n as fail } from "./_output-CC300DzW.mjs";
+import { n as log } from "./_ui-RZmPgrF6.mjs";
 import { a as errorMessage, n as binFromPackageJson, r as errorCode } from "./_utils-Ch0J4s6a.mjs";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alexkroman1/aai-cli",
-  "version": "5.8.1",
+  "version": "5.9.0",
   "type": "module",
   "bin": {
     "aai": "dist/cli.mjs"
@@ -37,8 +37,8 @@
     "p-timeout": "^7.0.1",
     "vite": "^8.1.5",
     "zod": "^4.4.3",
-    "@alexkroman1/aai-ui": "5.8.1",
-    "@alexkroman1/aai": "5.8.1"
+    "@alexkroman1/aai": "5.9.0",
+    "@alexkroman1/aai-ui": "5.9.0"
   },
   "devDependencies": {
     "playwright": "^1.61.1",